CVE-2026-22665 is an identity confusion vulnerability in prompts.chat caused by inconsistent case-sensitive and case-insensitive handling of usernames between write and read operations. This inconsistency allows attackers to register usernames that are case variants of existing ones, bypassing uniqueness enforcement. As a result, attackers can impersonate victim accounts, replace profile content on canonical URLs, and inject malicious metadata and content platform-wide. The vulnerability is classified under CWE-178 (Improper Handling of Case Sensitivity).

An attacker exploiting this vulnerability can impersonate legitimate users by registering usernames that differ only in case, potentially misleading other users and compromising trust. They can also replace profile content on canonical URLs, leading to misinformation or malicious content display. Additionally, attacker-controlled metadata and content injection can affect the integrity and reliability of the platform's data. The CVSS 4.0 score of 8.6 indicates a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a fix is released, users and administrators should monitor vendor communications for updates and consider implementing manual controls to detect and prevent case-variant username registrations if possible.